netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3g23-7g3r-898j
GHSA-4wqv-9wp5-h8x2
GHSA-5cfh-88x5-4pvc
GHSA-jc87-r4xp-8252
GHSA-m588-qhfh-q4qg
GHSA-r628-v28r-rwmg
GHSA-rvmj-3rpq-mg5g
This commit is contained in:
advisory-database[bot]
2025-05-03 18:31:40 +00:00
parent 753b046778
commit 80c8d52170
7 changed files with 335 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/05/GHSA-3g23-7g3r-898j/GHSA-3g23-7g3r-898j.json
+51
View File
@@ -0,0 +1,51 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3g23-7g3r-898j",
"modified": "2025-05-03T18:30:29Z",
"published": "2025-05-03T18:30:29Z",
"aliases": [
"CVE-2024-58134"
],
"details": "Mojolicious versions from 0.999922 through 9.39 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default.\n\nThese predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58134"
},
{
"type": "WEB",
"url": "https://github.com/hashcat/hashcat/pull/4090"
},
{
"type": "WEB",
"url": "https://github.com/mojolicious/mojo/pull/1791"
},
{
"type": "WEB",
"url": "https://github.com/mojolicious/mojo/pull/2200"
},
{
"type": "WEB",
"url": "https://medium.com/securing/baking-mojolicious-cookies-revisited-a-case-study-of-solving-security-problems-through-security-by-13da7c225802"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojolicious.pm#L51"
},
{
"type": "WEB",
"url": "https://www.synacktiv.com/publications/baking-mojolicious-cookies"
}
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-03T16:15:19Z"
}
}
advisories/unreviewed/2025/05/GHSA-4wqv-9wp5-h8x2/GHSA-4wqv-9wp5-h8x2.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4wqv-9wp5-h8x2",
"modified": "2025-05-03T18:30:29Z",
"published": "2025-05-03T18:30:29Z",
"aliases": [
"CVE-2025-4238"
],
"details": "A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. This affects an unknown part of the component MGET Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4238"
},
{
"type": "WEB",
"url": "https://fitoxs.com/exploit/exploit-a87ff679a2f3e71d9181a67b7542122c.txt"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.307329"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.307329"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.561561"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-03T17:15:45Z"
}
}
advisories/unreviewed/2025/05/GHSA-5cfh-88x5-4pvc/GHSA-5cfh-88x5-4pvc.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5cfh-88x5-4pvc",
"modified": "2025-05-03T18:30:30Z",
"published": "2025-05-03T18:30:29Z",
"aliases": [
"CVE-2025-4241"
],
"details": "A vulnerability classified as critical has been found in PHPGurukul Teacher Subject Allocation Management System 1.0. Affected is an unknown function of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4241"
},
{
"type": "WEB",
"url": "https://github.com/bluechips-zhao/myCVE/issues/6"
},
{
"type": "WEB",
"url": "https://phpgurukul.com"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.307332"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.307332"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.562452"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-03T18:15:16Z"
}
}
advisories/unreviewed/2025/05/GHSA-jc87-r4xp-8252/GHSA-jc87-r4xp-8252.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jc87-r4xp-8252",
"modified": "2025-05-03T18:30:29Z",
"published": "2025-05-03T18:30:29Z",
"aliases": [
"CVE-2025-4240"
],
"details": "A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. This issue affects some unknown processing of the component LCD Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4240"
},
{
"type": "WEB",
"url": "https://fitoxs.com/exploit/exploit-3c2b72a81c4f4fbe75903a2c9280d78fce69420fbc77e78ea6e73b34b735e70a.txt"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.307331"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.307331"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.561571"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-03T18:15:15Z"
}
}
advisories/unreviewed/2025/05/GHSA-m588-qhfh-q4qg/GHSA-m588-qhfh-q4qg.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m588-qhfh-q4qg",
"modified": "2025-05-03T18:30:29Z",
"published": "2025-05-03T18:30:29Z",
"aliases": [
"CVE-2025-1495"
],
"details": "IBM Business Automation Workflow 24.0.0 and 24.0.1 through 24.0.1 IF001 Center may leak sensitive information due to missing authorization validation.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1495"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7232434"
}
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-03T17:15:44Z"
}
}
advisories/unreviewed/2025/05/GHSA-r628-v28r-rwmg/GHSA-r628-v28r-rwmg.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r628-v28r-rwmg",
"modified": "2025-05-03T18:30:29Z",
"published": "2025-05-03T18:30:29Z",
"aliases": [
"CVE-2024-41753"
],
"details": "IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF004 and 24.0.1 through 24.0.1 IF001 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41753"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7232197"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-03T16:15:19Z"
}
}
advisories/unreviewed/2025/05/GHSA-rvmj-3rpq-mg5g/GHSA-rvmj-3rpq-mg5g.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rvmj-3rpq-mg5g",
"modified": "2025-05-03T18:30:29Z",
"published": "2025-05-03T18:30:29Z",
"aliases": [
"CVE-2025-4239"
],
"details": "A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. This vulnerability affects unknown code of the component TYPE Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4239"
},
{
"type": "WEB",
"url": "https://fitoxs.com/exploit/exploit-1679091c5a880faf6fb5e6087eb1b2dc.txt"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.307330"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.307330"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.561562"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-03T17:15:45Z"
}
}